Author Topic: Lexmark toner chip Ti046b1  (Read 12670 times)

jboard146 and 1 Guest are viewing this topic.

Offline JacquesBBB

  • Frequent Contributor
  • **
  • Posts: 682
  • Country: fr
Lexmark toner chip Ti046b1
« on: April 24, 2016, 03:11:48 PM »
I have a Lexmark CS310dn color Laser printer which has 4 cartridges which I bought about 150$.
Each of them has a chip  Ti046b1 which probably counts the number of copies ( I guess but may be wrong)
When the count is over in one cartridge, the printer stops.
A replacement black cartridge is 100$.

What is the real mechanism for this chip protection ?

Where can I find the datasheet or the pinout of the  Ti046b1 ?  I was not able to find it on the web. It seems that it is a FRAM memory, but I am not sure.

How to reset this printer chip ?

There are some chip available on the web, with the lexmark PCB, but rather expensive (about 25 $) while the chip can be available for only 1$ on  aliexpress. Should a simple replacement of the chip on the board work ?
It is a TSSOP 8 chip, and there nothing else on the board except some decoupling caps.

Thanks for any information on these Ti046b1 chips and chip protection mechanism.
 

Offline SeanB

  • Super Contributor
  • ***
  • Posts: 14373
  • Country: za
Re: Lexmark toner chip Ti046b1
« Reply #1 on: April 24, 2016, 05:09:05 PM »
It is a simple EEProm, used to store the count of pages printed and toner fill state. Also has a key that is used to authenticate the cartridge to the printer, and a cartridge serial number.

Try looking in printer refill suppliers for the compatible chips, which are either a programmed chip or a small micro that always reports the cartridge is full.
 

Offline JacquesBBB

  • Frequent Contributor
  • **
  • Posts: 682
  • Country: fr
Re: Lexmark toner chip Ti046b1
« Reply #2 on: April 24, 2016, 07:44:26 PM »
Thanks, but is it possible to  read and change the values in this eeprom ?

And what is the pinout ?

This is the chip



And from what I have looked I got the following schematics, with the 4 pads  JP1-4 connecting to the printer

« Last Edit: April 24, 2016, 08:00:12 PM by JacquesBBB »
 

Online Howardlong

  • Super Contributor
  • ***
  • Posts: 3886
  • Country: gb
Re: Lexmark toner chip Ti046b1
« Reply #3 on: April 24, 2016, 08:18:29 PM »
Looks like an I2C eeprom from the chip pinout, so...

J1 ground
J2 SDA
J3 Vdd
J4 SCL

 

Offline JacquesBBB

  • Frequent Contributor
  • **
  • Posts: 682
  • Country: fr
Re: Lexmark toner chip Ti046b1
« Reply #4 on: April 24, 2016, 09:00:13 PM »
Looks like an I2C eeprom from the chip pinout, so...

J1 ground
J2 SDA
J3 Vdd
J4 SCL

Thanks for this guess which lead me to try. I have a small I2C address reader that I made a while ago. The correct pinout is in fact

J1 ground
J2 SCL
J3 Vdd
J4 SDA

Then I got the I2C Address : 0x78

What should now be the way to go ?
 

Offline SeanB

  • Super Contributor
  • ***
  • Posts: 14373
  • Country: za
Re: Lexmark toner chip Ti046b1
« Reply #5 on: April 24, 2016, 09:51:59 PM »
Grab a non empty cartridge and write it's contents back to the empty one, and see the differences in the data as well. Print a few pages and see how the data changes, which might give enough data to simply reset the count, or make it look full again when refilled. Does the printer work without the chip in, some HP cartridges will give an error code but still print, assuming the chip is misaligned with the reader or it has failed, and then relying instead on the low toner optical path for change messages.
 

Online Howardlong

  • Super Contributor
  • ***
  • Posts: 3886
  • Country: gb
Re: Lexmark toner chip Ti046b1
« Reply #6 on: April 24, 2016, 09:52:40 PM »
Looks like an I2C eeprom from the chip pinout, so...

J1 ground
J2 SDA
J3 Vdd
J4 SCL

Thanks for this guess which lead me to try. I have a small I2C address reader that I made a while ago. The correct pinout is in fact

J1 ground
J2 SCL
J3 Vdd
J4 SDA

Then I got the I2C Address : 0x78

What should now be the way to go ?

While I can't discount your pinout findings of course, just be aware that there is an unofficial standard pinout for I2C eeproms, so I'd find it unusual to deviate from that, so you might want to just recheck your wiring.

https://proprojects.files.wordpress.com/2014/11/2014-11_i2c_24fc1025_im01.png

For example, Google the images returned from "i2c eeprom pinout".

Anyway, back to the problem in hand!

Can you probe the device in situ with a bus decoder? This can often reveal a lot.

 

Offline android

  • Regular Contributor
  • *
  • Posts: 131
  • Country: au
Re: Lexmark toner chip Ti046b1
« Reply #7 on: April 24, 2016, 10:08:41 PM »
Grab a non empty cartridge and write it's contents back to the empty one
...It might also be worth permanently enabling the Write Protect pin too, so that ithe EEPROM would always report "1 page printed" and not bother you in future. I've never tried it...just a thought.

I suspect that the stored data is encrypted - making it difficult to guess how the printer firmware would respond to various kinds of tinkering. The manufacturers really want you to buy more  consumables for some reason.
Lecturer: "There is no language in which a double positive implies a negative."
Student:  "Yeah...right."
 

Offline JacquesBBB

  • Frequent Contributor
  • **
  • Posts: 682
  • Country: fr
Re: Lexmark toner chip Ti046b1
« Reply #8 on: April 25, 2016, 01:16:22 AM »
@Howardlong : I confirm the pinout that I gave. I have been able to communicate with it with both my arduino based I2C scanner and Bus pirate 3.6 with it.

Now I am trying to dump the eeprom with bus pirate, but I  have never used it before

I can get some reading but I am not really sure of what I am doing.

What is the best way to dump the content of the eeprom ?

Thanks
 

Online Howardlong

  • Super Contributor
  • ***
  • Posts: 3886
  • Country: gb
Re: Lexmark toner chip Ti046b1
« Reply #9 on: April 25, 2016, 03:34:26 AM »
There are some additional confusions here.

The 0x78 address implies 10 bit addressing as opposed to the more common 7 bit addressing. 0x50-0x57 is the common addres range for eeproms. The schematic you gave even shows the address definition bits and WP pin all tied to how I would expect for an eeprom.

I don't know if Bus Pirate supports 10 bit addressing.

I would take a look at how the printer talks to the device before trying to copy it and match that up with known eeprom protocols. Like pinouts, these are reasonably well standardised so that manufacturers can offer plug in replacements.

 

Offline JacquesBBB

  • Frequent Contributor
  • **
  • Posts: 682
  • Country: fr
Re: Lexmark toner chip Ti046b1
« Reply #10 on: April 25, 2016, 04:02:25 AM »
The 0x78 address implies 10 bit addressing as opposed to the more common 7 bit addressing. 0x50-0x57

I had this value with my arduino reader, and this is what I get with the bus Pirate

I2C>(1)
Searching I2C address space. Found devices at:
0xF0(0x78 W) 0xF1(0x78 R)

 

Offline JacquesBBB

  • Frequent Contributor
  • **
  • Posts: 682
  • Country: fr
Re: Lexmark toner chip Ti046b1
« Reply #11 on: April 25, 2016, 07:25:32 AM »
In order to verify  what I get with the Bus Pirate,
I tried with a more conventional 24FC1026.

Then the pinout is standard  and I get
I2C>(1)
Searching I2C address space. Found devices at:
0xA0(0x50 W) 0xA1(0x50 R) 0xA2(0x51 W) 0xA3(0x51 R)

Thus the usual address as mentioned by Howardlong

I can then read and write on the chip


I2C>[ 0xa0 0 0 1 3 2 ]
I2C START BIT
WRITE: 0xA0 ACK
WRITE: 0x00 ACK
WRITE: 0x00 ACK
WRITE: 0x01 ACK
WRITE: 0x03 ACK
WRITE: 0x02 ACK
I2C STOP BIT
I2C>[ 0xa0 0 0 ] [ 0xa1 r:3 ]
I2C START BIT
WRITE: 0xA0 ACK
WRITE: 0x00 ACK
WRITE: 0x00 ACK
I2C STOP BIT
I2C START BIT
WRITE: 0xA1 ACK
READ: 0x01  ACK 0x03  ACK 0x02
NACK
I2C STOP BIT
I2C>

But it does not seem that the sequence is the same for the Ti046b1
As If I try the same sequence on  the Ti046b1 , I get

I2C>(1)
Searching I2C address space. Found devices at:
0xF0(0x78 W) 0xF1(0x78 R)


I2C>[ 0xF0 0 0 1 3 2 ]
I2C START BIT
WRITE: 0xF0 ACK
WRITE: 0x00 ACK
WRITE: 0x00 NACK
WRITE: 0x01 NACK
WRITE: 0x03 NACK
WRITE: 0x02 NACK
I2C STOP BIT

[ 0xF0 0 0 ] [ 0xF1 r:3 ]

I2C>[ 0xF0 0 0 ] [ 0xF1 r:3 ]
I2C START BIT
WRITE: 0xF0 ACK
WRITE: 0x00 ACK
WRITE: 0x00 NACK
I2C STOP BIT
I2C START BIT
WRITE: 0xF1 ACK
READ: 0xFF  ACK 0xFF  ACK 0xFF
NACK
I2C STOP BIT

So the behaviour of this chip is not the same as a standard  eeprom.

If anybody has the proper writing/reading sequence, it would be helpful.
 

Online Howardlong

  • Super Contributor
  • ***
  • Posts: 3886
  • Country: gb
Re: Lexmark toner chip Ti046b1
« Reply #12 on: April 25, 2016, 07:51:46 AM »
10 bit addressing works a little differently to 7 bit addressing, if that is indeed what it's doing. Whatever you're using to talk to the device needs to be 10-bit aware.

Definitely I would sniff out what the printer does to get an idea of what's going on, and look at the I2C specs UM10204 which explain the differences.
 

Offline JacquesBBB

  • Frequent Contributor
  • **
  • Posts: 682
  • Country: fr
Re: Lexmark toner chip Ti046b1
« Reply #13 on: April 25, 2016, 07:44:35 PM »
Thanks for your comments. I have started to look to 10 bit addressing...

But it is difficult to find reasonable information of  Bus Pirate and I2C 10 bit addressing.

I made an experiment by searching all possible addresses on the black cartridge
searching with Bus Pirate for all 256 in bunches like :
[0xF0 0x00]&[0xF0 0x01]&[0xF0 0x02]&[0xF0 0x03]&[0xF0 0x04]&[0xF0 0x05]&[0xF0 0x06]&[0xF0 0x07]

I got only positive answers for  0 and 1



DELAY 1us
I2C START BIT
WRITE: 0xF0 ACK
WRITE: 0x00 ACK
I2C STOP BIT
DELAY 1us
I2C START BIT
WRITE: 0xF0 ACK
WRITE: 0x01 ACK
I2C STOP BIT
DELAY 1us
I2C START BIT
WRITE: 0xF0 ACK
WRITE: 0x02 NACK
I2C STOP BIT


Then I searched  only for the first 8 addresses  for the other cartridges and found for the possible
second Byte

Black      : 0x00  and 0x01
Cyan      : 0x00  and 0x02
Magenta : 0x00  and 0x03
Yellow     : 0x00  and 0x04

So  this is some progress,  as I understand now how the different cartridges are recognised,
but I am not able to go further. I may need to sniff the I2C port as you recommend, but this will need a setting
that I  cannot do immediately, as I will have to dismount the printer to access the wires.
 

Offline igrok_by

  • Contributor
  • Posts: 16
  • Country: by
Re: Lexmark toner chip Ti046b1
« Reply #14 on: May 20, 2016, 05:19:08 PM »
you have success ???
I'm trying to get information from the chip , but it does not come out . To search using Bascom code :
Code: [Select]
$regfile = "m328pdef.dat"
$crystal = 8000000

Dim Q As Byte , T As Byte , A As Byte , E As Byte , R As Byte
Config Lcd = 16 * 2
Config Lcdpin = Pin , Rs = Portd.6 , E = Portd.3 , Db4 = Portc.0 , Db5 = Portc.1 , Db6 = Portc.2 , Db7 = Portc.3
Cursor Off
Cls
Locate 1 , 1
Lcd "Start"

Config Sda = Portd.5                                        'I2C Data
Config Scl = Portd.4                                        'I2C Clock
Wait 2

Do
Cls
For R = 0 To 127
 For T = 0 To 128                     
  I2cstart                                           
  Q = R * 2
  I2cwbyte Q                                     
  I2cwbyte T                                     
  E = Q + 1
  I2cstart
  I2cwbyte E                                               
  I2crbyte A , Nack                                     
  I2cstop                                                   
  Locate 1 , 1
  Lcd Q ; " " ; T ; " Read " ; A ; "    "
  If A < 255 Then
  Locate 2 , 1
  Lcd Q ; " " ; T ; " " ; A
  End If
  Wait 2
 Next T
Next R
Loop
End

The answer to all addresses 255. Is there a solution ???
 

Offline Hero999

  • Super Contributor
  • ***
  • Posts: 9002
  • Country: gb
Re: Lexmark toner chip Ti046b1
« Reply #15 on: May 20, 2016, 05:44:48 PM »
There's no way I'd buy a printer like this.

A bit off topic: are there any printers still around whith reasonably priced/easily refillable cartridges?
 

Offline igrok_by

  • Contributor
  • Posts: 16
  • Country: by
Re: Lexmark toner chip Ti046b1
« Reply #16 on: May 20, 2016, 05:51:26 PM »
A bit off topic: are there any printers still around whith reasonably priced/easily refillable cartridges?
Xerox, samsung.
 

Offline Gyro

  • Super Contributor
  • ***
  • Posts: 2542
  • Country: gb
Re: Lexmark toner chip Ti046b1
« Reply #17 on: May 20, 2016, 06:48:13 PM »
Some laser printers have a s/w setting for non-original cartridges, eg Dell.
Chris

"Victor Meldrew, the Crimson Avenger!"
 

Offline SeanB

  • Super Contributor
  • ***
  • Posts: 14373
  • Country: za
Re: Lexmark toner chip Ti046b1
« Reply #18 on: May 23, 2016, 05:14:23 AM »
HP as well, they are refillable, that is why I use them at work. Canon is a brand as well that also has refillable cartridges. The refilled cartridge coasts around 30% of the wholesale price, or around 20% of the retail price. There is a big mark up on cartridges all along the supply chain.

I just ask my refiller first if the cartridges on the printers I am considering are refillable, and this does winnow the list down to a dozen or so to choose from, and then often I look to see if the cartridge is one already in use. Just be aware that often HP and Canon cartridges are exactly the same unit, in a different box with a different part number, and a different price. Lot of Canon printers with me use HP cartridges. Same print quality, same operation and no "non genuine cartridge" message either on the new ones.
 

Offline igrok_by

  • Contributor
  • Posts: 16
  • Country: by
Re: Lexmark toner chip Ti046b1
« Reply #19 on: May 25, 2016, 04:31:36 PM »
There are still some who have ideas on the independent decision of zeroing chips.  :-BROKE
 

Offline cciollolo

  • Contributor
  • Posts: 7
  • Country: it
Re: Lexmark toner chip Ti046b1
« Reply #20 on: May 31, 2016, 06:53:10 AM »
hi , i have buy a cs310dn printer. i try to sniff with bus pirate but i have store more number with no result. The value changes every start of the printer and is different in all re-check in ready mode . i buy 10 new empty ti046b1 but i haven't idea to proceed . help please
 

Offline cciollolo

  • Contributor
  • Posts: 7
  • Country: it
Re: Lexmark toner chip Ti046b1
« Reply #21 on: June 01, 2016, 03:25:24 AM »
i attach the file with 24 times power on sniffer , and 5 time power on sniffer with the black cartridge removed . if someone has an idea to be tested , i'm available !  :-+ >:D
 

Offline Fungus

  • Super Contributor
  • ***
  • Posts: 6995
Re: Lexmark toner chip Ti046b1
« Reply #22 on: June 01, 2016, 06:15:31 AM »
...It might also be worth permanently enabling the Write Protect pin too, so that ithe EEPROM would always report "1 page printed" and not bother you in future. I've never tried it...just a thought.

If they've got any sense they'll be verifying the writes.

It's weird that they'd use an FRAM and not some write-once memory.  :popcorn:
 

Offline igrok_by

  • Contributor
  • Posts: 16
  • Country: by
Re: Lexmark toner chip Ti046b1
« Reply #23 on: June 02, 2016, 04:42:58 AM »
i attach the file with 24 times power on sniffer , and 5 time power on sniffer with the black cartridge removed . if someone has an idea to be tested , i'm available !  :-+ >:D
Did I understand you correctly??? An attempt to read the memory via a separate device ???

If they've got any sense they'll be verifying the writes.

It's weird that they'd use an FRAM and not some write-once memory.  :popcorn:
The fact that the chip is written in the page counter. As far as I understand it in these chips is:
1. The number of printing on many targeted chip (I found 10K, 20K)
2. The number of printable pages
3. Region kprintera.
4 for color, he must still be responsible for the color.

My reading of the sample controller chips Samsung alas, not what happened. But I realized that chip crypto protection.
« Last Edit: June 02, 2016, 04:48:22 AM by igrok_by »
 

Offline cciollolo

  • Contributor
  • Posts: 7
  • Country: it
Re: Lexmark toner chip Ti046b1
« Reply #24 on: June 03, 2016, 10:36:18 PM »
no , i turn on the printer and i sniff the initial trasmission that check all chips, and after turn off the printer and repeat for 24 times. the second file is the same procedure with the black cartridge chip removed . i did another test and i attach new file :
senza filo is the 3 initial check without cable off all chips
stamp pagina is the initial check with all chip connected and 2 separate page printed
cartucce mancanti is the recheck without one chip at once.

i made an attempt only with black chip to read the content inside of the chip, but after select the chip address with 0xf0 0x00 , i test to write the address of memory location , but when i read the chip answers always ff when the address is ack
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf